NIS2 readiness for suppliers and regulated organizations
Your NIS2-regulated partners now expect security assurance from you as well: a supplier questionnaire, contractual controls and evidence. We help you meet those expectations quickly, for a fixed fee and with truthful answers, including industrial (OT) environments.
Three typical situations
Supplier SME
Not regulated under NIS2 itself, but a large partner has sent a supplier security questionnaire or requires controls by contract. A quick assessment, the minimum controls in place and a questionnaire completed with truthful answers.
Regulated organization
The first audit is done, the gaps must be fixed, and compliance has to be demonstrated again in two years. A gap analysis based on the audit result, a remediation plan and its implementation.
Not sure if you are in scope
Based on size and sector we determine whether you are directly in scope and, if not, what to expect as a supplier.
The ten minimum cybersecurity measures
The assessment follows the measures listed in Article 21 of the NIS2 Directive. Each area is scored from 0 to 3 based on evidence: for backups, for example, we ask for the latest restore test, not just the policy.
01 Risk analysis and policy
A written information security policy and a documented risk assessment.
02 Incident handling
Who does what when something goes wrong: contacts, steps, logging and reporting deadlines.
03 Backup and business continuity
3-2-1 backups, an offline or immutable copy, and tested restores.
04 Supply chain
Who has external access to your systems: IT service provider, vendor remote maintenance, contractual requirements.
05 Vulnerability management
Patching process, supported operating systems, regular vulnerability scanning.
06 Measuring effectiveness
At least an annual review and internal check.
07 Cyber hygiene and training
Employee awareness training and phishing simulation.
08 Cryptography
Laptop disk encryption, TLS and a password manager.
09 Access control and asset inventory
Joiner and leaver process, permissions, hardware and software inventory.
10 Multi-factor authentication
MFA for e-mail, remote access and administrator accounts; an emergency communication channel.
One to two weeks, fixed fee
Initial call
30 minutes: who is asking, what the deadline is, what the environment looks like. Then a written fixed-fee proposal, NDA and contract.
Questionnaire and interview
A questionnaire of about 45 minutes, then a 2–3 hour interview with management and the IT lead, backed by evidence.
Technical check
With written authorization: external attack surface, e-mail security (SPF, DKIM, DMARC), Microsoft 365 or Google Workspace.
Report
A maturity score, the three biggest risks in business terms, a technical annex and a 30–60–90 day remediation plan.
Closing meeting
We walk through the results and the remediation steps and, on request, complete the supplier questionnaire.
What we fix in the first 30 days almost every time
For every user, starting with administrators and executives.
An offline or immutable copy and a documented restore test.
SPF, DKIM and DMARC against impersonation fraud.
Remote desktop and admin interfaces moved behind VPN and MFA.
What we do not do
In Hungary, an official cybersecurity audit may only be performed by an auditor registered with the regulator (SZTFH). We prepare you for the audit and for partner requirements, and carry out the remediation. Only truthful, evidence-backed statements go into a supplier questionnaire.
In industrial environments
For manufacturing and utility clients we pay particular attention to IT/OT segmentation and vendor remote maintenance. On production systems we only observe passively; active testing requires a separate OT engagement and a maintenance window. OT services →
Request a proposal
Briefly describe the system you would like tested and the reason for the engagement: a partner or regulatory requirement, an audit, or a new system going live. We will get back to you within one business day.